← All changes | protect/fw/rule/functions/wp.php +87 -32 5.38 → 6.76 View file →

		@@ -1,9 +1,10 @@
1	1	<?php
	2	+// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped
2	3	if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
3	4
4		-if (!trait_exists('MCProtectFWRuleWPFunc')) :
5		-trait MCProtectFWRuleWPFunc {
	5	+if (!trait_exists('WPRProtectFWRuleWPFunc_V676')) :
	6	+trait WPRProtectFWRuleWPFunc_V676 {
6	7	private function _rf_sanitizeUser() {
7	8	$args = $this->processRuleFunctionParams(
8	9	'sanitizeUser',
9	10	func_num_args(),
		@@ -13,10 +14,10 @@
13	14	);
14	15	$username = $args[0];
15	16	$strict = $args[1];
16	17
17		- if (!function_exists('sanitize_user') || !MCProtectUtils::haveMupluginsLoaded()) {
18		- throw new MCProtectRuleError(
	18	+ if (!function_exists('sanitize_user') || !WPRProtectUtils_V676::haveMupluginsLoaded()) {
	19	+ throw new WPRProtectRuleError_V676(
19	20	$this->addExState("sanitizeUser: Func sanitize_user doesn't exist.")
20	21	);
21	22	}
22	23
		@@ -31,10 +32,10 @@
31	32	1
32	33	);
33	34	$data = $args[0];
34	35
35		- if (!function_exists('maybe_serialize') || !MCProtectUtils::haveMupluginsLoaded()) {
36		- throw new MCProtectRuleError(
	36	+ if (!function_exists('maybe_serialize') || !WPRProtectUtils_V676::haveMupluginsLoaded()) {
	37	+ throw new WPRProtectRuleError_V676(
37	38	$this->addExState("maybeSerialize: Func maybe_serialize doesn't exist.")
38	39	);
39	40	}
40	41
		@@ -47,10 +48,10 @@
47	48	func_num_args(),
48	49	func_get_args()
49	50	);
50	51
51		- if (!function_exists('is_user_logged_in') || !MCProtectUtils::havePluginsLoaded()) {
52		- throw new MCProtectRuleError(
	52	+ if (!function_exists('is_user_logged_in') || !WPRProtectUtils_V676::havePluginsLoaded()) {
	53	+ throw new WPRProtectRuleError_V676(
53	54	$this->addExState("isUserLoggedIn: Func is_user_logged_in doesn't exist.")
54	55	);
55	56	}
56	57
		@@ -63,15 +64,15 @@
63	64	func_num_args(),
64	65	func_get_args()
65	66	);
66	67
67		- if (!function_exists('wp_get_current_user') || !MCProtectUtils::havePluginsLoaded()) {
68		- throw new MCProtectRuleError(
	68	+ if (!function_exists('wp_get_current_user') || !WPRProtectUtils_V676::havePluginsLoaded()) {
	69	+ throw new WPRProtectRuleError_V676(
69	70	$this->addExState("getCurrentWPUser: Func wp_get_current_user doesn't exist.")
70	71	);
71	72	}
72	73
73		- return MCProtectFWRuleEngine::toAllowedType(wp_get_current_user());
	74	+ return WPRProtectFWRuleEngine_V676::toAllowedType(wp_get_current_user());
74	75	}
75	76
76	77	private function _rf_currentUserCan() {
77	78	$args = $this->processRuleFunctionParams(
		@@ -84,10 +85,10 @@
84	85	$capability = $args[0];
85	86	$arg1 = isset($args[1]) ? $args[1] : null;
86	87	$arg2 = isset($args[2]) ? $args[2] : null;
87	88
88		- if (!function_exists('current_user_can') || !MCProtectUtils::havePluginsLoaded()) {
89		- throw new MCProtectRuleError(
	89	+ if (!function_exists('current_user_can') || !WPRProtectUtils_V676::havePluginsLoaded()) {
	90	+ throw new WPRProtectRuleError_V676(
90	91	$this->addExState("currentUserCan: Required funcs doesn't exist.")
91	92	);
92	93	}
93	94
		@@ -112,10 +113,10 @@
112	113	);
113	114	$field = $args[0];
114	115	$value = $args[1];
115	116
116		- if (!function_exists('get_user_by') || !MCProtectUtils::havePluginsLoaded()) {
117		- throw new MCProtectRuleError(
	117	+ if (!function_exists('get_user_by') || !WPRProtectUtils_V676::havePluginsLoaded()) {
	118	+ throw new WPRProtectRuleError_V676(
118	119	$this->addExState("getUserBy: Func get_user_by doesn't exist")
119	120	);
120	121	}
121	122
		@@ -120,14 +121,14 @@
120	121	}
121	122
122	123	if ($field === 'ID' || $field === 'id') {
123	124	if (!is_string($value) && !is_int($value)) {
124		- throw new MCProtectRuleError(
	125	+ throw new WPRProtectRuleError_V676(
125	126	$this->addExState("getUserBy: Value must be a valid string or an integer")
126	127	);
127	128	}
128	129	} elseif (!is_string($value)) {
129		- throw new MCProtectRuleError(
	130	+ throw new WPRProtectRuleError_V676(
130	131	$this->addExState("getUserBy: Value must be a valid string")
131	132	);
132	133	}
133	134
		@@ -135,9 +136,9 @@
135	136	if (false === $user) {
136	137	return null;
137	138	}
138	139
139		- return MCProtectFWRuleEngine::toAllowedType($user);
	140	+ return WPRProtectFWRuleEngine_V676::toAllowedType($user);
140	141	}
141	142
142	143	private function _rf_getCurrentWPUserCapabilities() {
143	144	$args = $this->processRuleFunctionParams(
		@@ -148,14 +149,14 @@
148	149
149	150	$user = $this->_rf_getCurrentWPUser();
150	151
151	152	if (!array_key_exists("allcaps", $user)) {
152		- throw new MCProtectRuleError(
	153	+ throw new WPRProtectRuleError_V676(
153	154	$this->addExState("getCurrentWPUserCapabilities: allcaps doesn't exist in user.")
154	155	);
155	156	}
156	157
157		- return MCProtectFWRuleEngine::toAllowedType($user["allcaps"]);
	158	+ return WPRProtectFWRuleEngine_V676::toAllowedType($user["allcaps"]);
158	159	}
159	160
160	161	private function _rf_getUserCapabilities() {
161	162	$args = $this->processRuleFunctionParams(
		@@ -171,14 +172,14 @@
171	172	return array();
172	173	}
173	174
174	175	if (!array_key_exists("allcaps", $user)) {
175		- throw new MCProtectRuleError(
	176	+ throw new WPRProtectRuleError_V676(
176	177	$this->addExState("getUserCapabilities: allcaps doesn't exist in user.")
177	178	);
178	179	}
179	180
180		- return MCProtectFWRuleEngine::toAllowedType($user["allcaps"]);
	181	+ return WPRProtectFWRuleEngine_V676::toAllowedType($user["allcaps"]);
181	182	}
182	183
183	184	private function _rf_getDefaultUserRole() {
184	185	$args = $this->processRuleFunctionParams(
		@@ -200,15 +201,15 @@
200	201	);
201	202	$option = $args[0];
202	203	$default_value = isset($args[1]) ? $args[1] : false;
203	204
204		- if (!function_exists('get_option') || !MCProtectUtils::haveMupluginsLoaded()) {
205		- throw new MCProtectRuleError(
	205	+ if (!function_exists('get_option') || !WPRProtectUtils_V676::haveMupluginsLoaded()) {
	206	+ throw new WPRProtectRuleError_V676(
206	207	$this->addExState("getOption: Func get_option doesn't exist.")
207	208	);
208	209	}
209	210
210		- return MCProtectFWRuleEngine::toAllowedType(get_option($option, $default_value));
	211	+ return WPRProtectFWRuleEngine_V676::toAllowedType(get_option($option, $default_value));
211	212	}
212	213
213	214	private function _rf_checkPasswordResetKey() {
214	215	$args = $this->processRuleFunctionParams(
		@@ -220,10 +221,10 @@
220	221	);
221	222	$key = $args[0];
222	223	$login = $args[1];
223	224
224		- if (!function_exists('check_password_reset_key') || !MCProtectUtils::havePluginsLoaded()) {
225		- throw new MCProtectRuleError(
	225	+ if (!function_exists('check_password_reset_key') || !WPRProtectUtils_V676::havePluginsLoaded()) {
	226	+ throw new WPRProtectRuleError_V676(
226	227	$this->addExState("checkPasswordResetKey: Func check_password_reset_key doesn't exist.")
227	228	);
228	229	}
229	230
		@@ -229,9 +230,9 @@
229	230
230	231	$user = check_password_reset_key($key, $login);
231	232
232	233	if (is_a($user, "WP_User")) {
233		- return MCProtectFWRuleEngine::toAllowedType($user);
	234	+ return WPRProtectFWRuleEngine_V676::toAllowedType($user);
234	235	}
235	236
236	237	return null;
237	238	}
		@@ -265,16 +266,70 @@
265	266	$params = $args[0];
266	267	$user_login = $args[1];
267	268
268	269	foreach ($params as $key => $value) {
269		- if (!is_string($value)) {
270		- continue;
271		- }
272		- if ($this->_rf_isActivationKeyValid($value, $user_login)) {
	270	+ if (is_array($value) && $this->_rf_hasValidActivationKey($value, $user_login)) {
273	271	return true;
	272	+ } elseif (is_string($value) && $this->_rf_isActivationKeyValid($value, $user_login)) {
	273	+ return true;
274	274	}
275	275	}
276	276
277	277	return false;
	278	+ }
	279	+
	280	+ private function _rf_wpUnslash() {
	281	+ $args = $this->processRuleFunctionParams(
	282	+ 'wpUnslash',
	283	+ func_num_args(),
	284	+ func_get_args(),
	285	+ 1
	286	+ );
	287	+ $value = $args[0];
	288	+
	289	+ if (!function_exists('wp_unslash') || !WPRProtectUtils_V676::haveMuPluginsLoaded()) {
	290	+ throw new WPRProtectRuleError_V676(
	291	+ $this->addExState("wpUnslash: Func wp_unslash doesn't exist.")
	292	+ );
	293	+ }
	294	+
	295	+ if (!is_string($value) && !is_array($value)) {
	296	+ throw new WPRProtectRuleError_V676(
	297	+ $this->addExState("wpUnslash: Value must be a valid string or an array")
	298	+ );
	299	+ }
	300	+
	301	+ return wp_unslash($value);
	302	+ }
	303	+
	304	+ private function _rf_parseResetPassCookie() {
	305	+ $args = $this->processRuleFunctionParams(
	306	+ 'parseResetPassCookie',
	307	+ func_num_args(),
	308	+ func_get_args()
	309	+ );
	310	+
	311	+ if (!defined('COOKIEHASH')) {
	312	+ throw new WPRProtectRuleError_V676(
	313	+ $this->addExState("parseResetPassCookie: COOKIEHASH is not defined.")
	314	+ );
	315	+ }
	316	+
	317	+ $cookie_name = 'wp-resetpass-' . COOKIEHASH;
	318	+ $cookies = $this->_rf_getCookiesV2();
	319	+ if (isset($cookies[$cookie_name])) {
	320	+ $cookie = $cookies[$cookie_name];
	321	+ }
	322	+
	323	+ if (isset($cookie) && is_string($cookie)) {
	324	+ $rp_arr = $this->_rf_splitString(':', $this->_rf_wpUnslash($cookie), 2);
	325	+
	326	+ if (is_array($rp_arr) && isset($rp_arr[0]) && is_string($rp_arr[0]) &&
	327	+ isset($rp_arr[1]) && is_string($rp_arr[1])) {
	328	+ return array("login" => $rp_arr[0], "key" => $rp_arr[1]);
	329	+ }
	330	+ }
	331	+
	332	+ return array("login" => "", "key" => "");
278	333	}
279	334	}
280	335	endif;